Threat Actors Hijack Enterprise AI Models in Costly LLMJacking Cloud Attacks
Do Son 
At a Glance
| Actor or Group | UNC6993, operators of Jet Night, and unattributed cybercrime clusters |
| Activity Type | LLMJacking, cloud credential theft, AI API quota theft, and illicit LLM mixer reselling |
| Targets or Victims | Financial services, retail, technology, and transportation sectors in North America, South America, and Asia Pacific |
| Scale | Over $100,000 per day in single-incident charges; cumulative losses reaching $1 million; surges exceeding 1,100 requests per second |
| Jurisdiction / Law Enforcement Status | Multi-jurisdictional; no public arrests or indictments announced |
TL;DR
Mandiant reported that threat actors are hijacking corporate AI access in widespread LLMJacking cloud attacks. These intruders steal cloud keys to run unauthorized queries or resell access through illicit gateway services. Consequently, enterprise LLMJacking cloud attacks have driven victim bills above one million dollars within days.
What Happened
In 2026, Google Threat Intelligence Group tracked multiple intrusions targeting large language models across enterprise cloud accounts. Attackers bypassed front-end chatbots to access backend model APIs directly. First, intruders obtained exposed cloud credentials, service account keys, and GitHub access tokens.
For instance, one group scanned public code repositories for corporate API keys. The actors tested these keys using minimal single-token requests to evade volumetric alarms. In another case, attackers exploited a user ID rebind vulnerability in the LiteLLM gateway, tracked as CVE-2026-40217. This flaw allowed the intruders to promote standard virtual keys into full administrative credentials.
In addition, attackers probed exposed Ollama endpoints by attempting to register custom models on public ports. As the Mandiant threat intelligence report notes, “Unlike the gradual resource consumption associated with cryptojacking, LLMJacking can generate large spikes in fraudulent cloud charges in a matter of hours.”
Who Is Behind It
Investigators attribute these intrusions to several financially motivated threat clusters operating globally. Mandiant tracks one active cluster as UNC6993 with moderate-to-high attribution confidence. This group compromised cloud instances through misconfigured service accounts and set up credential theft portals.
Furthermore, the investigation revealed an emerging division of labor across the cybercrime underground. Initial access brokers now sell compromised corporate accounts to specialized brokers called LLM Mixers. According to the report, “LLM Mixers function as illicit routing gateways that proxy, aggregate, and resell unauthorized LLM access to underground subscribers.”
These brokers use open-source software like new-api and gcli2api to balance query traffic across stolen accounts. Another suspected group operated under the persona D1337-KAIROS to deploy automated backend agents and reverse proxies.
Impact and Scale
The campaign impacted organizations across North America, South America, and the Asia Pacific region. Specifically, victims spanned the financial services, retail, technology, and transportation sectors. During peak attacks, request volumes surged to 1,100 calls per second, generating over 500,000 requests in eight hours.
In individual incidents, fraudulent consumption charges exceeded $100,000 in a single day. At some organizations, cumulative cloud bills reached $1 million before teams revoked the stolen keys. Meanwhile, stolen keys powered an underground subscription platform called Jet Night.
The platform advertised unlimited access to frontier models for approximately $60 per month. As researchers explained, “Given Jet Night’s per-token costs to users are so far below typical market rates GTIG believes the service relies on stolen keys to operate profitably.” However, the service suffered repeated outages on Telegram whenever victims revoked compromised credentials.
What Comes Next and How to Stay Protected
Threat actors will likely expand these attacks as enterprises integrate higher-tier generative models into production. Therefore, organizations must treat model keys as high-value credentials rather than standard development assets. Security teams should enforce strict spending quotas and rate limits across cloud AI services.
Additionally, administrators must scan code repositories for exposed service account keys and personal access tokens. Organizations should also restrict model routing interfaces like LiteLLM and patch known privilege escalation flaws promptly. Defenders must monitor API telemetry for sudden surges in single-token validation requests. Finally, companies should configure budget alerts to catch unauthorized model consumption before bills escalate.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
